CVE-2026-104745

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the algwcevverifyemail parameter in versions up to, and including, 3.3.0. The vulnerability exists because algwcevgenerateusercode generates the per-user activation secret using wprand10...

EUVD-2026-102615

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the algwcevverifyemail parameter in versions up to, and including, 3.3.0. The vulnerability exists because algwcevgenerateusercode generates the per-user activation secret using wprand10...

CVE-2026-104745

The Customer Email Verification for WooCommerce plugin for WordPress (versions

CVE-2026-104745 Customer Email Verification for WooCommerce <= 3.3.0 - Unauthenticated Privilege Escalation to 'alg_wc_ev_verify_email' Parameter

The Customer Email Verification for WooCommerce plugin for WordPress is vulnerable to Privilege Escalation via the algwcevverifyemail parameter in versions up to, and including, 3.3.0. The vulnerability exists because algwcevgenerateusercode generates the per-user activation secret using wprand10...

nogotofail

nogotofail Nogotofail is a network security testing tool designed to help developers and security researchers spot and fix weak TLS/SSL connections and sensitive cleartext traffic on devices and applications in a flexible, scalable, powerful way. It includes testing for common SSL certificate...

CVE-2021-2109_poc

weblogicCVE-2021-2109poc weblogic CVE-2021-2109 batch verification POC Usage: First, download JNDIExploit.jar on another server and run java -jar JNDIExploit.jar -i ip Then put the IPs to be checked in urls.txt, and run this script...

p5-ssl-tools

Collection of SSL Tools This repository contains various tools, which are intended to debug or analyze problems related to SSL/TLS. Analyzing state of TLS analyze-ssl.pl check support for various SSL/TLS version check which ciphers are support verfiy certificate check OCSP state check if SNI is...

kit

kit Tool registry manager -- manages developer toolchains from git-based registries, layered on top of mise. What it is kit resolves tool versions across multiple registries, generates mise configuration, verifies SHA-256 checksums against publisher release artifacts, verifies cosign signatures...

EUVD-2026-102523

The Apache Airflow SFTP provider's deferrable code paths SFTPTrigger, SFTPHookAsync, SFTPClientPool disable SSH host-key verification by default unless the connection explicitly sets nohostkeycheck to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attack...

PT-2026-115997

Improper verification of the source of a communication channel in the IPv6 Router Advertisement handler in Amazon FreeRTOS-Plus-TCP before V4.4.2 might allow a remote third-party to influence an endpoint's IPv6 default gateway, on-link prefix, and address configuration via a crafted Router...

PT-2026-115401

Name of the Vulnerable Software and Affected Versions Customer Email Verification for WooCommerce versions prior to 3.3.1 Description This issue allows unauthenticated attackers to gain authentication as any unverified WordPress account, including those with administrator privileges. The flaw...

AAMVA-PDF417-Vulnerability-Research

PDF417 ID Validation Vulnerability Research Overview This repository contains comprehensive security research documenting critical vulnerabilities in AAMVA-standard PDF417 barcode validation systems affecting government IDs, enterprise solutions, and consumer applications. The research includes a...

CVE-2026-94134

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless hostkey is configured or nohostkeycheck is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position...

CVE-2026-94135

The Apache Airflow SFTP provider's deferrable code paths SFTPTrigger, SFTPHookAsync, SFTPClientPool disable SSH host-key verification by default unless the connection explicitly sets nohostkeycheck to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attack...

CVE-2026-94135 Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default

The Apache Airflow SFTP provider's deferrable code paths SFTPTrigger, SFTPHookAsync, SFTPClientPool disable SSH host-key verification by default unless the connection explicitly sets nohostkeycheck to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attack...

CVE-2026-94135

The Apache Airflow SFTP provider contains a vulnerability where the deferrable code paths (SFTPTrigger , SFTPHookAsync , and SFTPClientPool ) disable SSH host-key verification by default. This occurs unless the connection explicitly sets no_host_key_check to false. Affected deployments running SF...

CVE-2026-94135 Apache Airflow SFTP provider: Async SFTP hook disables host-key verification by default

The Apache Airflow SFTP provider's deferrable code paths SFTPTrigger, SFTPHookAsync, SFTPClientPool disable SSH host-key verification by default unless the connection explicitly sets nohostkeycheck to false. Deployments that run SFTP sensors or operators in deferrable mode are affected. An attack...

CVE-2026-94134 Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless hostkey is configured or nohostkeycheck is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position...

CVE-2026-94134

The Apache Airflow SSH provider hook contains a vulnerability where it disables SSH host-key verification by default. Unless a host_key is configured or no_host_key_check is explicitly set to false, the hook accepts any server key. This affects both SSH and SFTP connections and allows an attacker...

CVE-2026-105036

EnergizeLab AI Station firmware, EilikO Linux robot firmware v2.120260617182218release, and the EnergizeLab Windows desktop app 3.1.2 download firmware updates over plain HTTP and do not verify their integrity or authenticity. An attacker able to intercept or modify the traffic can substitute a...